Most people know they should use better passwords. Most people don’t.
The same password, used across email, banking, social media, and the work Microsoft 365 account. Maybe with a “1” added to the end on the sites that force a number. Maybe with a capital letter at the start.
That’s not a password strategy. That’s a disaster waiting to happen.
Why it matters more than you think
When a website gets breached (and they do, constantly) the attackers don’t just sit on that data. They run it through automated tools that try your email and password combination against hundreds of other sites. Gmail. Outlook. LinkedIn. Your company’s remote access portal.
It’s called credential stuffing, and it works because people reuse passwords.
One breach from five years ago. A website you’ve probably forgotten you even signed up for. That’s all it takes for someone to walk straight into your email account.
What “good” actually looks like
Forget the old advice about special characters and changing every 90 days. That thinking has been retired by NCSC and NIST because it produces worse passwords, not better ones. People just cycle through predictable variations and write them on sticky notes.
What actually matters is length. A 16-character passphrase is far stronger than a complex 8-character password. “correct-horse-battery-staple” is genuinely harder to crack than “P@ssw0rd!”.
And the most important rule: every account gets its own unique password. Full stop.
The honest answer: use a password manager
The only realistic way to have a unique, long password for every account is a password manager. It generates them, stores them, and fills them in automatically. You remember one strong master password. That’s it.
Bitwarden is free and excellent. 1Password and Dashlane are solid paid options if you want business features and central management. There’s no realistic excuse not to use one.
What businesses should have in place
For business accounts, there are a few things worth getting right:
- A password policy. Minimum length, no reuse, and no sharing passwords between accounts.
- Multi-factor authentication. Even if a password is compromised, MFA stops the attacker getting in. We covered this in a previous post.
- No shared logins. Everyone gets their own account. Shared logins make it impossible to track who did what, and impossible to remove someone’s access cleanly when they leave.
- A review when someone leaves. Every account they had access to needs the password changed. Every single one.
The uncomfortable truth
Most breaches don’t start with a sophisticated attack. They start with someone trying a leaked password and it working.
Fixing your password hygiene is one of the most effective things you can do. It’s not complicated, and it costs nothing.
If you want help putting a proper policy in place for your team, that’s what we’re here for.
James
Attenu8 IT Support